A couple suspected of helping spread some of the Internet’s most aggressive computer viruses has been arrested in the English city of Manchester, police said Wednesday.
Scotland Yard’s electronic crimes unit said a man and a woman, both 20, were arrested Nov. 3 on suspicion of helping spread malicious Trojan computer programs sometimes known as “Zbot” or “ZeuS.”
Police said the viruses are thought to have infected tens of thousands of computers worldwide, and one technology consultant described them as the “most notorious pieces of malware of recent times.”
“This is one of the most frequent families of worms that we encounter,” said Graham Cluley, a technology consultant with the U.K. security firm Sophos PLC. “The ferocity with which it’s been spammed out on occasions has really hit our radar.”
Cluley said the Zbot family of viruses first came to his attention in 2007. Since then it has periodically swept across the Internet, stealing personal information from computers across the world and feeding it back to cyber-criminals. The viruses are commonly known as Trojans because they sneak onto computers and attack it from the inside, harvesting millions of lines of data — including banking information, credit card numbers and social networking passwords.
The viruses spread by sending e-mails or other messages from infected computers, impersonating banks, tax officials, credit card companies or even friends and enticing potential victims to click on a link.
Police said given the amount of information stolen “the potential financial gains to the culprits and losses to individuals and institutions are very substantial.”
Cluley said it was impossible to know just how much money had been lost to the viruses, adding that attacks were ongoing — including two in the past week alone.
It is not clear exactly what role the Manchester pair are suspected of playing in the viruses’ spread. Scotland Yard says the two have since been released on bail and declined to elaborate on their investigation.
Suspects in Britain are rarely identified unless they’ve been charged.
